10106 matches found
WordPress Abandoned Cart Pro for WooCommerce plugin <= 10.7.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation vulnerability
Missing Authorization to Authenticated Subscriber+ Privilege Escalation vulnerability discovered by d.v4ns3c in WordPress Plugin Abandoned Cart Pro for WooCommerce versions = 10.7.1...
CVE-2026-84066
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9 does not verify that the requesting user owns the post being modified before writing uploaded file references to its metadata, allowing users with the subscriber role and above to overwrite image...
CVE-2026-16281
The Classified Listing WordPress plugin before 6.1.1 does not verify that the caller owns or can edit the target listing before its AI image-editing AJAX action deletes or attaches media, allowing any authenticated user, including a subscriber, to permanently delete attachments from, and attach...
EUVD-2026-70912
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9 does not verify that the requesting user owns the post being modified before writing uploaded file references to its metadata, allowing users with the subscriber role and above to overwrite image...
CVE-2026-84066 Directorist < 8.9 - Subscriber+ Arbitrary Post Meta Write via atbdp_post_attachment_upload
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9 does not verify that the requesting user owns the post being modified before writing uploaded file references to its metadata, allowing users with the subscriber role and above to overwrite image...
CVE-2026-84066
Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin versions before 8.9 contain an arbitrary post meta write vulnerability in the atbdp_post_attachment_upload function. The plugin fails to verify that the requesting user owns the post being modified before writi...
WordPress Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin < 8.9 - Subscriber+ Arbitrary Post Meta Write vulnerability
Subscriber+ Arbitrary Post Meta Write vulnerability discovered by ryan zegar in WordPress Plugin Directorist versions 8.9...
EUVD-2026-70900
The Classified Listing WordPress plugin before 6.1.1 does not verify that the caller owns or can edit the target listing before its AI image-editing AJAX action deletes or attaches media, allowing any authenticated user, including a subscriber, to permanently delete attachments from, and attach...
CVE-2026-16281 Classified Listing < 6.1.1 - Subscriber+ Arbitrary Attachment Deletion and Listing Image Tampering via IDOR
The Classified Listing WordPress plugin before 6.1.1 does not verify that the caller owns or can edit the target listing before its AI image-editing AJAX action deletes or attaches media, allowing any authenticated user, including a subscriber, to permanently delete attachments from, and attach...
CVE-2026-84814
Subscriber Privilege Escalation in Bricksforge = 3.1.8.8 versions...
CVE-2026-84836
Subscriber Insecure Direct Object References IDOR in WC Ukraine Shipping = 1.22.3 versions...
CVE-2026-84779
Subscriber Broken Access Control in Agentimus – AI SEO, llms.txt & MCP for AI Agents = 1.51.0 versions...
CVE-2026-84756
Subscriber Privilege Escalation in WCFM Membership = 2.11.11 versions...
CVE-2026-81282
Subscriber Cross Site Scripting XSS in Product Variations Swatches for WooCommerce = 1.1.18 versions...
CVE-2026-81281
Subscriber Cross Site Scripting XSS in Graphene = 2.9.4 versions...
CVE-2026-84836 WordPress WC Ukraine Shipping plugin <= 1.22.3 - Insecure Direct Object References (IDOR) vulnerability
Subscriber Insecure Direct Object References IDOR in WC Ukraine Shipping = 1.22.3 versions...
CVE-2026-84836
WC Ukraine Shipping is a WordPress plugin affected by an Insecure Direct Object References (IDOR) vulnerability in versions 1.22.3 and earlier . The flaw allows a low-privilege user (Subscriber level) to access restricted objects, resulting in high confidentiality impact and low integrity impact,...
EUVD-2026-70568
Subscriber Insecure Direct Object References IDOR in WC Ukraine Shipping = 1.22.3 versions...
CVE-2026-84814
CVE-2026-84814 affects the WordPress Bricksforge plugin in versions 3.1.8.8 and below , introducing a Subscriber Privilege Escalation vulnerability. According to the PatchStack CVSS 3.1 assessment, the vulnerability is rated CRITICAL (9.8) with a network attack vector, low complexity, no required...